Ethereal-dev: Re: [Ethereal-dev] Patch to packet-eth.c - automatically interpret as FW1 monito

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Tue, 23 Nov 2004 22:24:00 -0800
Guy Harris wrote:
There's already an unconditional "interpret all Ethernet captures as FW1 monitor files" prefeerence; do *both* of those preferences need to exist?
As per your mail to me, I've checked in a variant of your patch, which doesn't add a new preference; instead, it makes the existing preference conditional, so that it only interprets frames as FW1 frames if they begin with 'i', 'I', 'o', or 'O'.
Can an FW1 monitor file contain 802.3 packets, with a length field, as well as Ethernet II packets, with a type field?
If so, should the check for the FW1 header be done in the FW1 dissector, so that it's called unconditionally if the preference is set, but it returns 0 if the packet doesn't look like an FW1 packet, and the Ethernet dissector dissects the packet itself if the FW1 dissector returns 0?